0

I want to block some ports access to the internet but still allow internal hosts to access the port with firewalld. There is another firewall between the internet and the host but I want to add a firewall on the host too.

Do I block the ports incoming and then add a whitelist rule to allow ports for the internal CIDR? I'm not sure how to do this with Firewalld.

Improve this question

1 Answer 1

Reset to default
0

Firewalld uses zones. The default zone is public, but it also by default includes home, work, and trusted.

Traffic not explicitly assigned to any zone uses public. You can list all the zones and their ports and services with --list-all-zones

  1. Assign the local traffic to one of the non-public zones. (--add-source with a subnet address) Trusted by default has all ports open.
  2. If the ports are not already open on the zone you select, add them. (--add-service or --add-port)
  3. Make sure the port is removed from public. By default, public only has ssh open I think.
Improve this answer
2
  • Are you saying that all the different zones are active all the time? I was under the impression that only the default zone was active.
    – Danie de Jager
    Commented Jul 4, 2022 at 12:50
  • --list-all-zones marks zones that are active (except the default public zone). All zones are active that have traffic assigned to them. I'm not suggesting all zones are active, I'm suggesting you pick one of those zones and make it active by assigning the local subnet to it.
    – user10489
    Commented Jul 4, 2022 at 16:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .